net: disable SSLv3 fallback.

net/base/net_error_list.h

Index: net/base/net_error_list.h
diff --git a/net/base/net_error_list.h b/net/base/net_error_list.h
index b805dd6ac7ecb01ddd4248bf412d78fb4973b123..e74e78a57ea31e98fde7f046108aea147e50c6f7 100644
--- a/net/base/net_error_list.h
+++ b/net/base/net_error_list.h
@@ -336,6 +336,10 @@ NET_ERROR(SOCKET_SEND_BUFFER_SIZE_UNCHANGEABLE, -163)
 // library.
 NET_ERROR(SSL_CLIENT_AUTH_CERT_BAD_FORMAT, -164)
 
+// The SSL connection needed a fallback version less than the configured
+// minimum fallback version.

[Ryan Sleevi, 2014/09/30 19:34:19]

This reads a little weird. Perhaps something like

// The SSL server requires falling back to a version weaker than the configured
minimum fallback version, and thus fallback failed.

(s/weaker/older/ or /less than/ for taste)

[agl, 2014/10/01 21:10:53]

Done.

+NET_ERROR(SSL_NEEDS_MORE_FALLBACK, -165)

[Ryan Sleevi, 2014/09/30 19:34:19]

NEEDS_MORE_FALLBACK is... a little less descriptive than I'd hope.

SSL_CANT_FALLBACK_BEYOND_MINIMUM_VERSION ?

That is, I'd hope that the error code tries to describe what's going on without
the error message.

I'm pretty flexible on this if you have alternatives, the concrete concern I
have with "needs more fallback" is that it feels like it combines two
comparators (more = greater than, fallback = less than). That is, you need more
of less security. Which is weird.

Something that can avoid words like "more" is ideal.

[agl, 2014/10/01 21:10:53]

Went with SSL_FALLBACK_BEYOND_MINIMUM_VERSION.

+
 // Certificate error codes
 //
 // The values of certificate error codes must be consecutive.